From: Tsiumis, Allison R. (CY D) (FBI) <Allison. Tsiumis@ic.fbi.gov> 


Sent: Tuesday, August 9, 2016 6:32 AM 

To: Ferranti, Colleen P. (CY D) (FBI) <Collcen. Ferranti@ic [bi.gov> 

Ce: Holt, Joda D. (DN) (FBI) <Joda.Holt@ic fbi.gov> 

Subject: Fwd: (((SITREP))) [UPDATE-3] Compromise of the Democratic Congressional Campaign Committee 
(DCCC) Network 


Colleen: Just FYI - Joda's team is on this with Ops IIL. 


-------- Original message -------- 

From: "Yearwood, Ronald J. (CYD) (FBD" <Ronald.Yearwood@èic.fbi.gov> 

Date: 08/09/2016 06:26 (GMT-05:00) 

To: "Holt, Joda D. (DN) (FBI)" <Joda.Holt(@ic.fbi.gov>, "Tsiumis, Allison R. (CY D) (FBI)" <Allison.Tsiumis@ic.fbi.gov> 
Cc: "Farrar, Aubrey B. (CYD) (FBD" <Aubrey .Farrar@ic.fbi.gov>, "Lowder, Jason P. (CYD) (FBD" 
<Jason.Lowder@ic.{bi.gov> 

Subject: Fwd: (((SITREP))) [UPDATE-3] Compromise of the Democratic Congressional Campaign Committce (DCCC) 
Network 


Purpose for the paper I mentioned yesterday. 


=------- Original message -------- 

From: "Buie, Emmerson (CY D) (FBI)" <Emmerson. Buie@ic.fbi. gov> 

Date: 08/09/2016 6:18 AM (GMT-05:00) 

To: "Trainor, James C. (CYD) (FBD" <James.Trainor@ic.fbi.gov>, "Sporre, Eric W. (CYD) (FBD" <Eric.Sporre@ic.fbi.gov>, 
"Yearwood, Ronald J. (CYD) (FBI)" <Ronald. Y earwood@ic.fbi.gov>, "Kelly, Jordan R. (CYD) (FBD" 
<Jordan.Kelly@ic.fbi.gov> 

Subject: Fwd: ((SITREP))) [UPDATE-3] Compromise of the Democratic Congressional Campaign Committee (DCCC) 
Network 


-------- Original message -------- 

From: "Heinze, Jeffrey P. (CYD) ŒBD" <Jeffrey.Heinze@ic.fbi.gov> 

Date: 08/08/2016 7:37 PM (GMT-05:00) 

To: "Buie, Emmerson (CYD) (FBD" <Emmerson Bute@ic fbi gov>, "Kelliher, Carolyn J. (CYD) (FBD" 
<Carolyn.Kelliher@ic.fbi.gov>, "Burnside, Jennifer S. (CY D) (FBD" <Jennifer. Burnside@ic.fbi.gov> 

Subject: Fwd: (((SITREP))) [UPDATE-3] Compromise of the Democratic Congressional Campaign Committee (DCCC) 
Network 


Tn case you weren't on the original distribution... 


FBI-DWS-12-0024234 
SCO-011774 


No. 1:21-cr-00582-CRC (D.D.C.) DX-125_0001 


-------- Original message -------- 

From: NCCIC@us-cert.gov 

Date: 08/08/2016 7:30 PM (GMT-05:00) 

To: NCCIC@us-cert.gov, NCCIC@hq.dhs. gov, ascyber@hq.dhs.gov, Danny.Toler@us-cert.gov, John.Felker@hq.dhs. gov, 
Gregory. Touhill@hq.dhs.gov, Tom.Baer@hq.dhs. gov, andy.ozment(@hq.dhs.gov, NCCIC_Leadership@hq.dhs. gov, 
necic_chiefs@hq.dhs.gov, daniel. medina@hq.dhs.gov, Eric.Goldstein@hq.dhs gov 

Ce: Carl. Deputy @hq.dhs.gov, eric.schneider@hq.dhs.gov, NCCIC@hq.dhs.gov. nec @hq.dhs.gov, SWO@us-cert.goy, ics- 
cert(@hq.dhs.gov, NICC@HQ.DHS.GOV, oge@hq.dhs.gov, michael .howell@hq.dhs.goy, noc.ndd@hq.dhs.govy, 
noc.swo.restricted@hq.dhs. gov, alexandra.friedman@HQ.DHS.GOV, Richard.Harris@hq.dhs. gov, Daniel. Donahue@us- 
cert.gov, john.robinson @hq.dhs. gov, Dennis.Lalena@hq.dhs. gov, Carl. Deputy @hq.dhs.gov, cric.schneider@hq. dhs. gov, 
NCCIC@hq.dhs. gov, nec(@hq.dhs.gov, SWO@us-cert.gov, ics-cert(@hq.dhs.gov, NICC@HQ.DHS.GOV, oge@hq.dhs. gov, 
michael.howell@hq.dhs.gov, noc.ndd@hq.dhs. gov, noc.swo.restricted@hq.dhs.gov. alexandra. friedman@HQ.DHS.GOV, 
Richard.Harris@hq.dhs.gov, Daniel. Donahue@us-cert.gov. DL-CyberCenters@us-cert. gov, necicinternallno@hq.dhs. gov. 
SOC @msisac.org, "Buic, Emmerson (CYD) (FBI)" <Emmerson. Buic@ic.fbi.gov>. "Buic, Emmerson (DHS)" 
<ebuie@hq.dhs.gov>, "Heinze, Jeffrey P. (CYD) FBD" <Jefftey Heinze @ic.fbi.gov>, jeffrey.p.heinze@hq.dhs.gov. 
jeanette.manfra(@hq.dhs.gov, monica.leon@hq.dhs. gov, angela.m.koulters@hq.dhs. gov, eric.tamarkin@hq.dhs.gov, 
jason.lamote@hq.dhs.gov, bridgette.walsh@hq.dhs.gov. alexandra. friedman@hq.dhs.gov 

Subject: ((SITREP))) [UPDATE-3] Compromise of the Democratic Congressional Campaign Committee (DCCC) Network 


(U/FOQUO) 


TLP: AMBER 


PART 
Wa 


National Cybersecurity & Communications Integration Center 
NCCIC 


NCCIC Situational Report (((SITREP))) [UPDATE-3] 


August 8, 2016 


This SITREP pertains to intrusions into the Democratic National Committee (DNC) and Democratic Congressional 
Campaign Committee (DCCC). NCCIC has deemed it necessary to raise the severity schema from Level 2 Medium 
(Yellow) to Level 3 High (Orange) based on an assessment that the incident likely has had a demonstrable impact on 
foreign relations and public confidence. 


INCIDENT: 


Friday, August 5, 2016 - The NCCIC initiated a dialogue with the Clinton Presidential campaign Chief Operating 
Officer (COO) and Chief Information Officer (CIO) to offer NCCICaE™s technical assistance. 


FBI-DWS-12-0024235 
$CO-011775 


No. 1:21-cr-00582-CRC (D.D.C.) DX-125_0002 


Friday, August 5, 2016 - the FBI delivered a DVD of artifacts from the DNC and DCCC investigation to NCCIC for 
analysis. The initial analysis will be completed this week. 


Wednesday, August 3, 2016 - NCCIC conducted a conference call, with Mr. Michael Sussmann, Attorney for 
Perkins Coie representing DNC / DCCC. NCCIC will continue further discussions with Mr. Sussmann at a later date. 


The dialogue with the Republican National Committee (RNC) was established to offer NCCICA€™s technical 
assistance. Further discussions will likely take place this week. 


NCCIC expects to receive a call from the Trump Campaign this week at which time there will be an offer made to 
provide technical assistance. 


Wednesday, June 22, 2016 - NCCIC was notified by a trusted private sector partner of a potential network breach 
of the DCCC network. NCCIC shared the information with the FBI, who recognized that this was likely tied to the 
ongoing investigation of the DNC incident. The FBI is the investigative lead for this incident. 


The DNC hired a cybersecurity firm to conduct an in-depth investigation of their network. The FBI is investigating 
the DNC incident. 


CAUSE: Malicious cyber actors gained unauthorized access the DCCC network. 


CURRENT ACTIONS: 


NCCIC will notify the Cyber Response Group (CRG) of the elevation change to Level 3 Orange. 


NCCIC will offer technical assistance to all U.S. Presidential candidates who are qualified for USSS protection. 


NCCIC is maintaining situational awareness with FBI CyWatch and the other Federal Cyber Centers. 


INFORMATION: 


Schema: Level 3 High (Orange) â€" Likely to result in a demonstrable impact to public health or safety, national 
security, economic security, foreign relations, civil liberties, or public confidence. 


FBI-DWS-12-0024236 
S$CO-011776 


No. 1:21-cr-00582-CRC (D.D.C.) DX-125_0003 


National Cybersecurity & Communications Integration Center 
Department of Homeland Security 

COMM/STE: (703) 235-5273 

Unclassified: NCCIC @us-cert.gov 

HSDN: NCCIC@dhs.sqgov.gov 

JWICS: NCCIC@dhs .ic.gov 

OV 


Info addressees: 
CS&C Leadership 
NCCIC Director 
NCCIC Deputy Director 
NCCIC Chiefs 

NCCIC Components 
NCCIC Internal LNOs 
NICC 

DHS NOC 


CyWatch 


NSC 


Woming: The documentis UNCLASSIFIED //FOR OFFICIAL USE ONLY (U//FOUD) i contains Mformotion thot moy be exempt fiom public release under the Freedom of | 
informonon Act (3 U.S.C S52). its to be controle, tored, bandied, tronsmi ted, dit buted, ond disposed of in occordancewith DHS pok cy relating to FOUO njormation 
ondisnot to be released to the public, the m edio, or aher personne! who do not hove o valid need-to-know without pia opprovol of an outhonzed OHS official. 


TLP: AMBER 


(U//FOUO) 


FBI-DWS-12-0024237 
SCO-011777 


No. 1:21-cr-00582-CRC (D.D.C.) DX-125_0004 


